This invention relates to computer systems, and more particularly to a system for detecting computer user account aliases.
As it is known in the art, effective computer operating system security measures help prevent unauthorized access to and theft of proprietary software, software plans, and computer time. These measures can also protect equipment, software, and computer files from damage caused by tampering. The source of a security breach on a computer system can usually be traced to one of three categories: user irresponsibility, user probing, or user penetration.
User irresponsibility usually refers to situations where an authorized user purposely or accidently causes some noticeable damage. An example would be a computer user who is authorized to access certain computer files, makes an authorized copy of a key file to improperly transfer. This type of breach can be characterized as a breach of trust. There is little that a computer operating system can do to protect sites from this source of security failure, since the initial access to the file was completely authorized, and the breach occurred by the improper transfer of the fruits of the authorized access.
User probing refers to situations where a computer user obtains unauthorized access by exploiting insufficiently protected parts of the computer system. Probing typically reflects an exploration of top-level facilities to which a computer user has legitimate access to browse through the computer system.
User penetration refers to an attempt to bypass existing security controls by finding relatively obscure flaws in their implementation.
To guard against user probing and user penetration, computer systems typically include processes to authenticate the identity of a user. Authentication of a user identity in a computer system is the verification of a user's identity so that security policies can properly be applied to requests from that user. Authentication typically involves the examination of an individual's credentials, such as biometric information, encryptographic information, and so forth.
In medium- to large-scale distributed computer systems, it is often the case that a given computer user may well have access to the computer network via several different computer user accounts, each individually legitimate. For example, a computer user might have access to the computer across the network via an employee's computer system in the work place, and via a personal computer with a modem at home. Where separation of duties or similar policies are to be enforced by a computer network server, techniques should exist for the computer network server to determine whether or not two different computer requests are from distinct or different individuals. Where one individual can access two or more user accounts those accounts are known as alias accounts of that one individual.
An alias, therefore, is defined as an alternate identity for any individual who is held accountable for his/her actions. Where the possibility of alias computer user accounts exists, the straightforward comparison of authentication data, e.g., passwords, public keys, etc., is insufficient to prevent unwanted aliasing of a user, simply because there are typically no controls in effect to prevent one user from obtaining distinct user accounts containing potentially distinct authentication information.
One type of computer security required in many business and commercial applications has come to be called a policy for the separation of duties. This policy requires that, for critical business procedures, certain steps of that business procedure must be performed by different individuals. The purpose of this policy is to distribute responsibility for a transaction among several different people so that no one person, acting alone, can cause the action in question to occur. The presumption is that distinct or different individuals having different responsibilities will act as checks on each other.
An example of a policy for the separation of duties which may be encountered in every day life would be a personal safety deposit box. A bank usually requires a bank employee and the safety deposit owner to use two distinct keys and both to sign a log book in order for the safety deposit box owner to gain access to the safety deposit box. Requiring two keys is referred to as access control. Requiring both individuals to sign a log is referred to as audit control. The bank policy is that the owner and bank employee must be two distinct or different individuals. Another example would be when a business employee hands in an expense form and would like to be issued a company check for those expenses. Corporate policy would require that the expense check may not be signed and authorized by the same person. These two examples illustrate that the principle of separation of duties is widely required for manual systems.
Several approaches have been advanced in the past for enforcing separation of duties policies. The most common approach for enforcement of separation of duties in automated computer systems has been for a security administrator to define distinct groups or roles and to manually ensure that the assignment of the individuals to critical groups or roles does not overlap. One problem with this approach is that it does not prevent a threat from a given individual who may have access to a computer system from two distinct accounts.
Known approaches to the authentication and identification of users by user account have generally presupposed that user account aliasing is prevented by the use of operational or procedural rules. Approaches for enforcing a separation of duties policy have assumed that aliasing does not occur, and that authenticatible user account identities are therefore sufficient to identify individuals as well. The problem with this approach is that the premise that alias accounts do not exist particularly in large computer systems is generally incorrect.
Moreover, preventing account aliasing becomes more and more impracticable as networks grow larger and larger. Even if identifying information unique to an individual, such as biometric information, is obtained when a new account is created, in order to associate that new user account with any other user account that may exist for that individual on the network, an exhaustive search over every user account already in the system would have to be performed. Such a search is costly even for relatively small computer networks, and is effectively impossible for large computer networks.
One further type of user authentication uses biometric reader information which is fed to the computer system during login. Biometric information is provided from a biometric reader at each login point or station. A biometric reader can typically detect unique information or characteristics of an individual such as eye scans, thumbprints, DNA sampling, and so forth. While the use of biometric information for purposes of user authentication is often performed, it is generally expensive because biometric readers are needed at every login point. In addition, if biometric information is ever disclosed, there is no way to undo the damage. For these reasons, continued use of encryptographic information such as passwords and/or smart cards have usually been indicated as a better alternative for authentication than biometrics.